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Several protocols for controlled teleportation were suggested by Yang, Chu, and Han [PRA 70, 
022329 (2004)]. In these protocols, Alice teleports qubits (in an unknown state) to Bob iff a controller 
allows it. We view this problem in the perspective of secure multi-party quantum computation. We 
show that the suggested entanglement- efficient protocols for m-qubit controlled teleportation are 
open to cheating; Alice and Bob may teleport (m — I )-qubits of quantum information, out of the 
controllers' control. We conjecture that the straightforward protocol for controlled teleportation, 
which requires each controller to hold m entangled qubits, is optimal. We prove this conjecture for 
a limited, but interesting, subset of protocols. 
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I. INTRODUCTION 

Secure multi-party quantum computation (MPQC) 
protocol 3] allows n players to compute an agreed quan- 
tum circuit where each player has access only to his own 
arbitrary quantum input. A MPQC protocol has two 
phases: In the sharing phase, players dubbed dealers pro- 
vide the other players with their initial state. In the re- 
construction phase, the honest players help a designated 
player reconstruct the final state of the protocol. Dur- 
ing the latter phase, only local operations and classical 
computation is available. 

In this paper we view controlled teleportation as a spe- 
cial case of MPQC. A dealer named Carol hands Alice 
and Bob an (entangled) initial state \iPabc)- A second 
dealer, named David, provides Alice with an unknown 
m-qubit state p. The task of Alice and Bob is to recon- 
struct (teleport) p into Bob's hands, when Carol allows it. 
\tpABc) is sucrl that Carol controls whether the teleporta- 
tion can take place. Carol and David are honest dealers. 
We call a controlled teleportation protocol secure if it is 
impossible for malicious Alice and Bob to teleport any 
part of p before the reconstruction phase. Namely, if Al- 
ice and Bob can build a state p' at Bob's hands which 
has non-trivial fidelity with p before the reconstruction 
phase, the protocol is insecure. 

The straightforward solution to this problem, sug- 
gested in 0, is to use a procedure described in 0, 
First, Carol prepares the following 3m-qubit state and 
gives Alice and Bob their respective qubits 



i=l \GHZ) ABC{i) — 
2=1 i}^) AB(i) l+)c?(i) 



and Carol. Later, if Carol wishes to allow the teleporta- 
tion, she measures her m qubits in the Hadamard basis, 
and publishes her results Ci G {+,—}. Now, the state 
shared by Alice and Bob is <g>™ 1 \4> Ci ) which can be freely 
used by them for teleportation. 

On the other hand, if Carol abstains from participa- 
tion, the state shared by Alice and Bob can be calculated 
by tracing over Carol's qubits 



tvc®? =1 \GHZ) (GHZ\ ABC{1) = 
®™ i ( 00) (oo\ Am + |11) (iiu s(i . 



(2) 



We note here, that without the participation of Carol, 
the state shared by Alice and Bob becomes a classical 
correlation, which cannot facilitate quantum teleporta- 
tion. 

Ref. provides a second protocol, in which Carol 
holds only one entangled qubit, aiming at the same task. 
This entanglement-efficient protocol can be stated as fol- 
lows: Carol creates the following 2(m + l)-qubit state 
and gives Alice and Bob their respective qubits 
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Later, if Carol wishes to allow the teleportation, she mea- 
sures her single qubit in the computational basis and 
publishes her result. Alice measures her own rightmost 
qubit in the computational basis. If it is equal to Carol's 
outcome, then Alice and Bob share ®£Li \4> + ) AB(i)- 

Oth- 
erwise, they share ®£L l \<l>~) abw Either way, they can 
safely teleport m qubits. On the other hand, if Carol 
abstains from participation, and if Alice and Bob con- 
tinue the protocol exactly as planned, they can no longer 
teleport Alice's m-qubit message reliably, since they will 
create a mixed state 0, Eq. (11)] instead. 



(Here, and throughout the paper, we drop normaliza- 
tion factors for readability), {|V' ± )j|0 ± )} are the four 
Bell-BMR0 states, |±) = and \GHZ) ABC{i) = 

l 000 )^ 111 ) is the ith GHZ state shared among Alice, Bob 
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II. ALICE AND BOB CAN CHEAT CAROL 

In fact, in the second protocol, even if Carol does not 
participate, malicious Alice and Bob can let Alice tele- 
port any (m — l)-qubit state to Bob. The abstention of 
Carol mixes the shared state to create 



\AB{i) 
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where 1 is the totally mixed state in one qubit. Yet 
Alice and Bob can easily distill it pj . Each of them has 
to relinquish his or her mth qubit and measure it in the 
computational basis. If their results coincide, they share 

Si^l^ABw; otherwise the y share l^ABdy 

Either way, they can safely teleport any (m — l)-qubit 
state and thus reconstruct any m-qubit state with high 
fidelity. 

It is important to note that never claimed that Bob 
can learn nothing about Alice's state, and they stated 
openly that they did not "attempt a comprehensive study 
of the security against all possible forms of eavesdrop- 
ping and/or cheating". However, it is equally important 
to note that their efficient protocol for multiqubit quan- 
tum information teleportation via the control of an agent, 
is insecure. The same malady affects their protocol for 
multiple controllers (see Section llVjl . 



III. CAROL NEEDS m ENTANGLED QUBITS 

When Carol held a single qubit entangled to Alice and 
Bob, she could control only one of their qubits, and not 
the rest. We believe that this is not an accident. We 
conjecture that Carol must have at least m entangled 
qubits with Alice and Bob if she wants to completely 
control their ability to teleport an m-qubit state. 

We prove a special case of this conjecture. We de- 
fine a limited form of secure controlled teleportation. 
In the limited form, we assume three additional limi- 
tations, (a) The initial state shared by Alice, Bob and 
Carol is pure. (b) If Carol abstains, the remaining state 
Pab = trc \iPabc) {tpABc\ is separable. (c) In the re- 
construction phase, Carol performs her measurement on 
the shared state without obtaining any prior information 
from Alice and Bob; Alice and Bob do not help Carol to 
assist them. [Tfjj 

These limitations are not true in general, since the 
initially-shared state may be mixed, since a bound- 
entangled state is probably equally unhelpful for Alice 
and Bob if they want to perform teleportation, and since 
the reconstruction phase can be more complex. Note 
that these limitations leave enough room for interesting 
protocols. Specifically, the protocols of satisfy limita- 
tions (a) and (c), and the ones not satisfying (b) can be 
cheated because of that. 

Limitation (c) means that the highest value of entan- 
glement that Alice and Bob can create between them 
with the help of Carol is EoA 1 (pab), the entanglement 
of assistance, which in turn is limited by EoA°°(pab)- 
Recently, Smolin, Verstraete, and Winter showed that 

EoA°°(pab) < min(S(A), S(B)). (5) 

Let us now assume that a secure limited controlled 
teleportation protocol exists, i.e. there exists \ipABc) 
so that pab = tr c\^abc) (ipABc\ is separable, while 
EoA 1 (pab) > m. Since pab is separable, S(pab) > 



max.(S(A),S(B)). We conclude that 
(b) 

S(pab) > max(S(A),S(B)) 

i 

> mm(S(A),S(B)) > EoA°°(p AB ) (6) 

(c) 

> EoA 1 (pab) > m. 

But since \ipABc) is pure, S(pab) is exactly the initial en- 
tanglement of Carol with Alice and Bob. Thus, a limited 
controlled teleportation protocol requires Carol to hold 
no less than m entangled bits — just as in the straightfor- 
ward protocol. 

IV. MULTIPLE CONTROLLERS 

In an extended problem presented in 0, Carol is re- 
placed by n controllers: If all the controllers participate, 
Alice can teleport an m-qubit message to Bob. But even 
if a single controller abstains, the teleportation has to be 
impossible. 

In the straightforward protocol achieving this, the con- 
trollers prepare the following (n + 2)m-qubit state and 
give each participant his or her respective qubits 

®™i \GHZ) ABCn(%) = 

V even |a;| 

\<i>-) AB{i) H® n £ \ X ) Cn J (7) 

odd|a:| / 

where H® n is the Hadamard transform on n qubits, and 
the summations are over the n-bit strings x whose Ham- 
ming weight \x\ is even (odd). Later, when all the con- 
trollers wish to allow the teleportation, each of them ap- 
ply the Hadamard transform to her first qubit, measures 
it in the computational basis, and publishes her result. 
If the number of "l"s published by all controllers is even 
(odd), Alice and Bob share \cj) + ) (\4>~))- Either way, they 
can safely teleport one qubit. This is repeated on the 
m — 1 sets of remaining qubits. 

On the other hand, if even a single controller abstains, 
the complete state becomes a classical correlation, un- 
worthy for teleportation. 

In this protocol each controller initially holds m en- 
tangled bits with the rest of the system. Much like as 
in the case of a single controller, the protocol cannot be 
improved by another protocol of the limited form. 

If all n controllers participate, they can be thought of 
as one, and m < EoA(pab) < min(S'(A), S(B)). 

If one of the controllers (C) abstains, we require 
that PabC"- 1 would become separable. Again, this 
means that each controller's entanglement with the 
rest of the system S(C') = S(pabc"- 1 ) nas to be 
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more than max(S(A), S(B)) and certainly more than 
min(S(A),S{B)) >m. 

Any limited controlled teleportation protocol that tries 
to be more entanglement-efficient than that, is insecure. 
For example, in the shared state suggested in 0, Eq. (21)] 

®7=i \<t> + ) AB{{) ® \GHZ + ) ACn + 

®? =1 \r) AB{{) ®\GHZ_) Acn (8) 

(where \GHZ ± ) = |0...0) ± is an n + 1 qubit state 

share by Alice and the n controllers) there is only one 
bit of entanglement between the group of all controllers 



and the Alice and Bob pair. Therefore, Alice and Bob 
can again ignore the controllers and remain with a state 
useful for teleportation. 
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